fix(codebuild): encryptionKey cannot be disabled
#10474
Conversation
Because of a limitation of the CodeBuild Service API and its CloudFormation implementation, it is not possible to disable the encryption key used to encrypt uploaded artifacts after having deployed a Project once that uses a key (the update back to "no key" is ignored). Work around this by explicitly always selecting the default `alias/aws/s3` key. This is the same one CodeBuild would have used if no key was given, except it doesn't suffer from the "property cannot be made empty" problem.
|
Blocked waiting for a response from CodeBuild acknowledging that this workaround is sane. |
There was a problem hiding this comment.
Thanks for extracting this to a separate PR Rico!
This is fine from a code perspective, so I'm OK with approving it. I still feel like we should push on the CodeBuild team to address this at the source (that is, their APIs), as this affects all CloudFormation customers, not only CDK customers, and will likely be a deployment change for a huge portion of CDK users (everyone that uses CodeBuild without encryption will see a diff after this has been released).
But I understand the realities of mitigating damage vs. long-term fixes, and so I'll leave it in your hands Rico on when to exactly merge this in.
|
Confirmed to be a valid workaround by CodeBuild |
|
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
KMS keys for cross-account actions used to be created automatically, but incur a $1/month charge for every region, adding a charge you don't need if you don't plan to deploy in to cross-account destinations. Add the option `crossAccountKeys: false` to allow users to switch off the KMS keys and avoid the charge if they don't need it. Relates to #10115. Must not be merged before #10474. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Because of a limitation of the CodeBuild Service API and its
CloudFormation implementation, it is not possible to disable the
encryption key used to encrypt uploaded artifacts after having deployed
a Project once that uses a key (the update back to "no key" is ignored).
Work around this by explicitly always selecting the default
alias/aws/s3key. This is the same one CodeBuild would have used ifno key was given, except it doesn't suffer from the "property cannot
be made empty" problem.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license